New NIST Password Guidelines: What Changed and What to Do

Last Updated on September 15, 2026 by Editorial

Passwords have changed, and many of the rules you’ve followed for years are now outdated. The new NIST password guidelines put much more emphasis on password length, unique credentials, and modern authentication practices.

The changes matter because traditional password policies often forced users to create credentials that looked complicated but remained predictable. Rules such as adding one uppercase letter, one number, and one symbol can produce passwords that attackers can easily guess.

NIST now takes a different approach. Its latest Digital Identity Guidelines require at least 15 characters for passwords used as a single authentication factor. It also requires at least eight characters when the password forms part of a multi factor authentication process.

Here’s what the new NIST password guidelines mean for you and for organizations that manage user accounts.

What Are the New NIST Password Guidelines?

The guidelines appear in NIST Special Publication 800 63B, which covers authentication and digital identity management. Below are some of the new guidelines.

1. Use Longer Passwords Instead of Forced Complexity

The biggest change is the new minimum length.

For a password used as a single factor, NIST requires at least 15 characters. If you use the password as part of multi factor authentication, the minimum can be eight characters.

This doesn’t mean you should aim for exactly 15 characters. A longer password can give you more protection against guessing attacks, particularly when you choose it randomly or create a strong passphrase.

For example, a long passphrase made from unrelated words can be more practical than a short password packed with symbols.

The important point is that length gives you more room to create a secret that’s difficult to guess without forcing you to memorize an arbitrary string of characters.

2. Stop Forcing Uppercase Letters, Numbers, and Symbols

The new NIST password guidelines reject the idea that every password needs a particular mixture of character types.

NIST specifically says verifiers must not impose composition rules. That means a service shouldn’t require you to add a capital letter, number, or special character simply to satisfy a password policy.

Why does this matter?

People tend to respond to these rules in predictable ways. Someone might turn “password” into “Password1!” because the website requires an uppercase letter, number, and symbol.

That password looks more complicated, but the changes follow a pattern that attackers already know.

NIST’s guidance points to research showing that composition rules provide less protection than expected while making passwords harder to remember.

The goal isn’t to ban symbols or numbers. You can still use them. The difference is that the website shouldn’t force you to use them.

3. Stop Changing Your Password Every 30 or 90 Days

Regular password expiration has been common in workplaces for years. The new NIST password guidelines take a different position.

NIST says organizations must not require users to change passwords periodically. They should force a password change when there’s evidence that the authenticator has been compromised.

There’s a practical reason for this rule.

When people know they’ll need a new password every few months, they often make minor changes to their existing one. A password ending in “1” might become “2,” then “3,” for example.

Attackers know these patterns. If they obtain an old password, they can try common variations rather than starting from scratch. NIST’s FAQ specifically points to this behavior as one reason arbitrary password expiration can provide a false sense of security.

You should change a password after a breach, suspected exposure, or suspicious account activity. You don’t need to change it simply because 90 days have passed.

4. Block Common and Compromised Passwords

Length alone doesn’t make every password safe. Consider a 15 character password that has appeared in a previous data breach. An attacker can test it immediately because they already know it exists.

That’s why the new NIST password guidelines require services to compare new passwords against a blocklist of commonly used, expected, or compromised passwords.

These lists can contain passwords from previous breaches, common dictionary words, repetitive patterns, and terms associated with the specific service.

For example, a website shouldn’t accept a password based on its own name or a common variation of the user’s name.

This approach deals with a major weakness in traditional password policies. A password can satisfy every complexity rule and still be a password attackers have seen thousands of times.

5. Allow Passwords of at Least 64 Characters

NIST also wants systems to stop placing unnecessarily low limits on password length.

The latest guidance says organizations should permit a maximum password length of at least 64 characters. It also recommends accepting spaces and printable ASCII characters. Unicode characters should also be accepted.

This gives users room to create long passphrases.

A passphrase uses several words or other text as a password. Because it can be much longer than a traditional password, it can provide a useful combination of length and memorability.

You don’t need to create a 64 character password for every account. The important point is that the service shouldn’t reject a strong credential simply because it exceeds an arbitrary length limit.

NIST also says systems shouldn’t truncate passwords. The verifier should receive and check the complete password you submit.

6. Use a Password Manager

Managing a different long password for every account creates a memory problem.

A password manager solves much of that problem by generating and storing unique credentials for your accounts. NIST explicitly requires verifiers to allow password managers and autofill functionality. It also recommends permitting copy and paste where autofill isn’t available.

This matters because password reuse creates a serious chain reaction.

Suppose you use the same password for an email account, shopping account, and work service. If one company suffers a breach, dangerous hackers can try the stolen credentials against your other accounts.

A password manager lets you use a different password for each service without memorizing every credential.

You should still protect the password manager itself with a strong master credential and multi factor authentication where available.

7. Security Questions Are No Longer a Good Password Alternative

Many websites still ask questions such as your first pet’s name or your mother’s maiden name.

The new NIST password guidelines specifically reject knowledge based authentication for password selection. NIST says services must not prompt users to use security questions or similar knowledge based methods.

The problem is that many answers aren’t really secret.

Someone may find your pet’s name through social media or discover other personal details through public records and previous data breaches.

Security questions also tend to have a limited number of possible answers. That makes them attractive targets for guessing attacks.

A strong authentication system should rely on credentials and authentication factors that provide better protection than publicly discoverable personal information.

8. Passwords Alone Still Have Major Weaknesses

The new NIST password guidelines don’t suggest that longer passwords solve every authentication problem.

NIST explicitly states that passwords aren’t phishing resistant. An attacker can trick you into entering a strong 20 character password on a fraudulent website, and the password’s length won’t stop the theft.

That’s why you should use multi factor authentication whenever a service provides it.

Multi factor authentication requires another form of proof in addition to your password. This could include an authenticator app, security key, or another approved authentication method.

Passkeys can also reduce reliance on passwords for supported services. They use cryptographic credentials rather than asking you to type a password into a website.

The best password policy is still limited if the authentication system remains vulnerable to phishing.

Old Password Rules vs New NIST Password Guidelines

The difference is clear. NIST has moved away from rules that dictate how a password should look. It places more attention on whether the credential is long, unique, and likely to resist guessing.

Common Misunderstandings About the New NIST Password Guidelines

There are some misunderstandings that can make adopting the new guidelines a little hard.

“NIST Says Special Characters Are Bad”

That’s incorrect.

NIST doesn’t prohibit special characters. It says services shouldn’t force users to include specific character types. You can still use symbols, numbers, uppercase letters, and other characters in your password.

“You Never Need to Change Your Password”

That’s also incorrect.

NIST says services shouldn’t force periodic password changes. A password should still be changed when there’s evidence that it has been compromised.

“Any 15 Character Password Is Secure”

Length helps, but it isn’t the whole story.

A 15 character password that appears in a breach or uses an obvious pattern can still be a poor choice. This is why NIST requires services to check new passwords against blocklists.

“Password Length Is the Only Thing That Matters”

Length is one important factor, but your password also needs to remain secret and unique.

Phishing, malware, credential theft, and password reuse can defeat even a long password. That’s why password managers and multi factor authentication remain important.

What the New NIST Password Guidelines Mean for Businesses

Businesses should review their existing password policies against the latest NIST guidance.

The first step is to remove unnecessary composition requirements. Requiring a capital letter, number, and symbol doesn’t automatically produce a stronger password.

Next, review password expiration rules. If your organization forces employees to change passwords every 60 or 90 days, consider whether that policy has a clear security reason.

Your authentication system should also block common and compromised passwords. NIST requires services to compare new passwords against a blocklist before accepting them.

You should also allow passwords of at least 64 characters, accept spaces and supported Unicode characters, and avoid truncating submitted passwords.

Password managers should work properly with your login forms. Blocking paste or autofill can make it harder for employees to use strong, unique credentials.

Finally, store passwords correctly. NIST requires passwords to be salted and hashed using a suitable password hashing scheme that makes offline guessing attacks expensive.

The Bottom Line

The new NIST password guidelines mark a clear shift away from old password rules.

You don’t need to force yourself to create a short password packed with symbols, numbers, and uppercase letters. Instead, use long and unique passwords, avoid credentials that appear in breach lists, and use a password manager.

The result is a password policy based more on how attackers actually operate and less on rules that merely make passwords look complicated.

FAQ